Threats tagged 'bit-libpython-2024-0450'

The CPython zipfile module in versions prior to 3.8.19, 3.9.19, 3.10.14, 3.11.8, and 3.12.2 is vulnerable to a 'quoted-overlap' zip-bomb attack. This vulnerability allows specially crafted zip archives with overlapping entries to achieve a high compression ratio, potentially leading to resource exhaustion when decompressed. Fixed versions reject zip archives with overlapping entries to mitigate this risk.